Firmware in certain Milesight AIOT cameras contains hard‑coded credentials, allowing an attacker who can reach the device to log in without knowing a valid password. The flaw is identified as CWE‑798 and permits the unauthenticated user to access the management interface, modify configuration settings, capture video streams, or perform other privileged operations.

Milesight AIOT camera models affected include MS‑C2964‑RFLPC, MS‑C2966‑RFLWPC, MS‑C2966‑X12RLPC, MS‑C2966‑X12RLVPC, MS‑C2972‑RFLPC, MS‑C5321‑FPE, MS‑C5361‑X12LPC, MS‑C5366‑X12LPC, MS‑C5366‑X12LVPC, MS‑C8477‑HPG1, MS‑C8477‑PC, MS‑CQxx31‑xxxG1, MS‑CQxx68‑xxxG1, MS‑CQxx72‑xxxG1, MS‑Cxx41‑xxxPE, MS‑Cxx52‑xxxPE, MS‑Cxx61‑xxxPE, MS‑Cxx62‑xxxG1, MS‑Cxx72‑xxxG1, MS‑Cxx75‑xxPD, MS‑Cxx83‑xPD, MS‑Nxxxx‑NxE, MS‑Nxxxx‑xxC, MS‑PMC8266‑FPE, MS‑PMC8266‑FGPE, MS‑SC211, MS‑SP111, MS‑TS2841‑X36TPC, MS‑TS2866‑X4TGPC, MS‑TS2966‑X12TPE, MS‑TS4441‑X36RE, and many related models within the MS‑Cxx and MS‑TS series.

The CVSS score of 7.7 indicates a high severity risk, while the EPSS score of less than 1% shows a low current probability of exploitation. The flaw is not listed in CISA KEV. Based on the description, it is inferred that an attacker must reach the camera through the network or local interface to use the embedded credentials and gain access. Once authenticated, the attacker can perform any action available to an authorized user, which could compromise confidentiality, integrity, and availability of the device.